{"id":"CLSA-2026-1785489136","summary":"Fix CVE(s): CVE-2026-11386, CVE-2026-12391, CVE-2026-9494","details":"   * SECURITY UPDATE: Pro bearer token exposed via apt-helper command line\n     - Write APT credentials to a temporary 0600 auth file and pass a\n       credential-free URL to apt-helper, instead of embedding the token in\n       the download-file URL argument where it leaked to local users via\n       /proc/\u003cpid\u003e/cmdline. Source tarball re-packed with the fix (3.0 native).\n     - cve-2026-9494\n   * SECURITY UPDATE: APT source injection via crafted contract-server response\n     - validate contract directives (aptURL, suites, additionalPackages) to\n       reject newline/CR/NUL/space characters, preventing injection of\n       attacker-controlled lines into root-owned apt sources and the apt-get\n       install invocation. Source tarball re-packed with the fix (3.0 native).\n     - cve-2026-11386\n   * SECURITY UPDATE: symlink file disclosure in \"pro collect-logs\"\n     - Skip symlinked user log files and create the diagnostic archive\n       exclusively (x:gz) with a root-only umask so an existing output file or\n       symlink is not followed or overwritten. Source tarball re-packed with\n       the fix (3.0 native).\n     - cve-2026-12391","modified":"2026-10-26T09:31:47.407989316Z","published":"2026-07-31T09:12:32Z","upstream":["CVE-2026-11386","CVE-2026-12391","CVE-2026-9494"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1785489136.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11386"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12391"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9494"}],"affected":[{"package":{"name":"ubuntu-advantage-pro","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/ubuntu-advantage-pro?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:32.3~18.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1785489136.json"}},{"package":{"name":"ubuntu-advantage-tools","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/ubuntu-advantage-tools?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:32.3~18.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1785489136.json"}},{"package":{"name":"ubuntu-pro-auto-attach","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/ubuntu-pro-auto-attach?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:32.3~18.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1785489136.json"}},{"package":{"name":"ubuntu-pro-client","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/ubuntu-pro-client?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:32.3~18.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1785489136.json"}},{"package":{"name":"ubuntu-pro-client-l10n","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/ubuntu-pro-client-l10n?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:32.3~18.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1785489136.json"}}],"schema_version":"1.9.0"}